build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.24 to 1.19.32 by dependabot[bot] · Pull Request #321 · iggy/botkube

dependabot · 2026-07-09T12:27:51Z

Bumps github.com/aws/aws-sdk-go-v2/credentials from 1.19.24 to 1.19.32.

Commits

3bf9ef9 Release 2026-07-29
3f0db65 Regenerated Clients
3212c1c Update endpoints model
554a97c Update API model
789968e Request compression content length test (#3497)
70fc819 generate serde benchmarks (#3492)
5cf37fb Release 2026-07-28
63ee662 Regenerated Clients
c4668b7 Update API model
8599448 Migrate serde2 kitchensink eventstream tests to smithy-go/eventstream (#3498)
Additional commits viewable in compare view

github-actions · 2026-07-09T12:38:44Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes	no	no	2.64s
✅ REPOSITORY	betterleaks	yes	no	no	1.54s
✅ REPOSITORY	checkov	yes	no	no	19.79s
⚠️ REPOSITORY	devskim	yes	1	no	4.07s
✅ REPOSITORY	dustilock	yes	no	no	0.03s
✅ REPOSITORY	gitleaks	yes	no	no	11.34s
✅ REPOSITORY	git_diff	yes	no	no	0.16s
❌ REPOSITORY	grype	yes	4	no	69.74s
✅ REPOSITORY	kingfisher	yes	no	no	10.97s
⚠️ REPOSITORY	osv-scanner	yes	3	no	1.69s
✅ REPOSITORY	secretlint	yes	no	no	5.29s
✅ REPOSITORY	syft	yes	no	no	4.01s
❌ REPOSITORY	trivy	yes	1	no	14.52s
✅ REPOSITORY	trivy-sbom	yes	no	no	11.42s
✅ REPOSITORY	trufflehog	yes	no	no	4.91s

Detailed Issues

❌ REPOSITORY / grype - 4 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME                           INSTALLED  FIXED IN  TYPE       VULNERABILITY        SEVERITY  EPSS         RISK  
golang.org/x/text              v0.38.0    0.39.0    go-module  GO-2026-5970         High      0.4% (36th)  0.3   
golang.org/x/net               v0.55.0    0.56.0    go-module  GO-2026-5942         High      0.3% (26th)  0.3   
oras.land/oras-go/v2           v2.6.1               go-module  GHSA-fxhp-mv3v-67qp  High      0.3% (27th)  0.3   
google.golang.org/grpc         v1.82.0    1.82.1    go-module  GHSA-hrxh-6v49-42gf  High      N/A          N/A   
github.com/klauspost/compress  v1.18.5    1.18.7    go-module  GO-2026-5841         Unknown   N/A          N/A   
golang.org/x/crypto            v0.53.0              go-module  GO-2026-5932         Unknown   N/A          N/A
[0069] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / trivy - 1 error

───────────────┼───────────────────┤
│ docs/investigation/rbac/assets/role.yaml         │ kubernetes │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/clusterrole.yaml          │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/clusterrolebinding.yaml   │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/communicationsecret.yaml  │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/deployment.yaml           │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/global-config.yaml        │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/persistent-config.yaml    │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/rbac-groups.yaml          │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/service.yaml              │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/serviceaccount.yaml       │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/system-config.yaml        │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/systemroles.yaml          │    helm    │        -        │         0         │
└──────────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


go.mod (gomod)
==============
Total: 5 (UNKNOWN: 2, LOW: 0, MEDIUM: 0, HIGH: 3, CRITICAL: 0)

┌────────────────────────┬─────────────────────┬──────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │  Status  │ Installed Version │ Fixed Version │                            Title                            │
├────────────────────────┼─────────────────────┼──────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto    │ GO-2026-5932        │ UNKNOWN  │ affected │ v0.53.0           │               │ The golang.org/x/crypto/openpgp package is unmaintained,    │
│                        │                     │          │          │                   │               │ unsafe by design, and has known security...                 │
├────────────────────────┼─────────────────────┤          ├──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/net       │ CVE-2026-46600      │          │ fixed    │ v0.55.0           │ 0.56.0        │ Parsing an invalid SVCB or HTTPS RR can panic when the      │
│                        │                     │          │          │                   │               │ size...                                                     │
│                        │                     │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46600                  │
├────────────────────────┼─────────────────────┼──────────┤          ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/text      │ CVE-2026-56852      │ HIGH     │          │ v0.38.0           │ 0.39.0        │ A norm.Iter can enter an infinite loop when handling input  │
│                        │                     │          │          │                   │               │ containing ...                                              │
│                        │                     │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56852                  │
├────────────────────────┼─────────────────────┤          │          ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-hrxh-6v49-42gf │          │          │ v1.82.0           │ 1.82.1        │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities                │
│                        │                     │          │          │                   │               │ https://github.com/advisories/GHSA-hrxh-6v49-42gf           │
├────────────────────────┼─────────────────────┤          ├──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ oras.land/oras-go/v2   │ CVE-2026-50163      │          │ affected │ v2.6.1            │               │ oras-go: Oras-go: Information disclosure and arbitrary file │
│                        │                     │          │          │                   │               │ access via crafted tarball hardlinks...                     │
│                        │                     │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-50163                  │
└────────────────────────┴─────────────────────┴──────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

test/go.mod (gomod)
===================
Total: 4 (UNKNOWN: 2, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0)

┌────────────────────────┬─────────────────────┬──────────┬──────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │  Status  │ Installed Version │ Fixed Version │                           Title                            │
├────────────────────────┼─────────────────────┼──────────┼──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto    │ GO-2026-5932        │ UNKNOWN  │ affected │ v0.52.0           │               │ The golang.org/x/crypto/openpgp package is unmaintained,   │
│                        │                     │          │          │                   │               │ unsafe by design, and has known security...                │
├────────────────────────┼─────────────────────┤          ├──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ golang.org/x/net       │ CVE-2026-46600      │          │ fixed    │ v0.55.0           │ 0.56.0        │ Parsing an invalid SVCB or HTTPS RR can panic when the     │
│                        │                     │          │          │                   │               │ size...                                                    │
│                        │                     │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46600                 │
├────────────────────────┼─────────────────────┼──────────┤          ├───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ golang.org/x/text      │ CVE-2026-56852      │ HIGH     │          │ v0.37.0           │ 0.39.0        │ A norm.Iter can enter an infinite loop when handling input │
│                        │                     │          │          │                   │               │ containing ...                                             │
│                        │                     │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56852                 │
├────────────────────────┼─────────────────────┤          │          ├───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-hrxh-6v49-42gf │          │          │ v1.81.1           │ 1.82.1        │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities               │
│                        │                     │          │          │                   │               │ https://github.com/advisories/GHSA-hrxh-6v49-42gf          │
└────────────────────────┴─────────────────────┴──────────┴──────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.72.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 10000 characters out of 16225)

⚠️ REPOSITORY / devskim - 1 error

i":"pkg/bot/discord.go"},"region":{"startLine":27,"startColumn":3,"endLine":27,"endColumn":7,"charOffset":588,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/execute/executor.go"},"region":{"startLine":149,"startColumn":6,"endLine":149,"endColumn":10,"charOffset":4950,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_cloud.go"},"region":{"startLine":571,"startColumn":4,"endLine":571,"endColumn":8,"charOffset":18684,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_cloud.go"},"region":{"startLine":349,"startColumn":7,"endLine":349,"endColumn":11,"charOffset":11675,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"internal/executor/kubectl/builder/kubectl_dropdowns.go"},"region":{"startLine":134,"startColumn":5,"endLine":134,"endColumn":9,"charOffset":3427,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"internal/config/testdata/TestGetProvider/third.yaml"},"region":{"startLine":5,"startColumn":18,"endLine":5,"endColumn":27,"charOffset":73,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"internal/config/testdata/TestGetProvider/all.yaml"},"region":{"startLine":17,"startColumn":18,"endLine":17,"endColumn":27,"charOffset":383,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"internal/config/testdata/TestGetProvider/from-cli-flag-second.yaml"},"region":{"startLine":5,"startColumn":18,"endLine":5,"endColumn":27,"charOffset":74,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/mattermost.go"},"region":{"startLine":358,"startColumn":4,"endLine":358,"endColumn":8,"charOffset":11218,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/mattermost.go"},"region":{"startLine":47,"startColumn":3,"endLine":47,"endColumn":7,"charOffset":1269,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/formatx/space_table.go"},"region":{"startLine":28,"startColumn":3,"endLine":28,"endColumn":7,"charOffset":517,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/mattermost.go"},"region":{"startLine":28,"startColumn":3,"endLine":28,"endColumn":7,"charOffset":581,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_socket.go"},"region":{"startLine":250,"startColumn":9,"endLine":250,"endColumn":13,"charOffset":8620,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_socket.go"},"region":{"startLine":32,"startColumn":3,"endLine":32,"endColumn":7,"charOffset":769,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"examples/ingress-recommendations/ingress-overrides.yaml"},"region":{"startLine":28,"startColumn":28,"endLine":28,"endColumn":37,"charOffset":612,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"hack/target/serve-plugins/main.go"},"region":{"startLine":16,"startColumn":66,"endLine":16,"endColumn":75,"charOffset":334,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS112852","level":"note","message":{"text":"Go - Hard-coded SSL/TLS Protocol"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/grpcx/credentials.go"},"region":{"startLine":47,"startColumn":39,"endLine":47,"endColumn":51,"charOffset":1393,"charLength":12,"snippet":{"text":"VersionTLS13","rendered":{"text":"VersionTLS13","markdown":"`VersionTLS13`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Cryptography.Protocol.TLS.Hard-Coded"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_renderer_test.go"},"region":{"startLine":50,"startColumn":30,"endLine":50,"endColumn":39,"charOffset":1426,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"internal/source/kubernetes/recommendation/ingress_backend_service_valid.go"},"region":{"startLine":59,"startColumn":7,"endLine":59,"endColumn":11,"charOffset":2041,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/branch-build.yml"},"region":{"startLine":16,"startColumn":27,"endLine":16,"endColumn":31,"charOffset":318,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}}],"columnKind":"utf16CodeUnits"}]}

(Truncated to last 10000 characters out of 24930)

⚠️ REPOSITORY / osv-scanner - 3 errors

Scanning dir .
Starting filesystem walk for root: /
Scanned examples/src/go.mod file and found 9 packages
Scanned go.mod file and found 260 packages
Scanned test/go.mod file and found 167 packages
End status: 212 dirs visited, 910 inodes visited, 3 Extract calls, 73.554084ms elapsed, 73.554244ms wall time
Filtered 1 local/unscannable package/s from the scan.
Failed to run code analysis (govulncheck) on 'examples/src/go.mod' because govulncheck: loading packages: err: exit status 1: stderr: go: go.mod requires go >= 1.26.4 (running go 1.26.3; GOTOOLCHAIN=local)

(the Go toolchain is required)
Failed to run code analysis (govulncheck) on 'go.mod' because govulncheck: loading packages: err: exit status 1: stderr: go: go.mod requires go >= 1.26.4 (running go 1.26.3; GOTOOLCHAIN=local)

(the Go toolchain is required)
Failed to run code analysis (govulncheck) on 'test/go.mod' because govulncheck: loading packages: err: exit status 1: stderr: go: go.mod requires go >= 1.26.4 (running go 1.26.3; GOTOOLCHAIN=local)

(the Go toolchain is required)

Total 15 packages affected by 21 known vulnerabilities (0 Critical, 3 High, 0 Medium, 0 Low, 18 Unknown) from 1 ecosystem.
19 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-------------------------------+---------+---------------+---------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE                       | VERSION | FIXED VERSION | SOURCE              |
+-------------------------------------+------+-----------+-------------------------------+---------+---------------+---------------------+
| https://osv.dev/GO-2026-4961        |      | Go        | golang.org/x/image            | 0.41.0  | 0.42.0        | examples/src/go.mod |
| https://osv.dev/GO-2026-5061        |      | Go        | golang.org/x/image            | 0.41.0  | 0.43.0        | examples/src/go.mod |
| https://osv.dev/GO-2026-5062        |      | Go        | golang.org/x/image            | 0.41.0  | 0.43.0        | examples/src/go.mod |
| https://osv.dev/GO-2026-5066        |      | Go        | golang.org/x/image            | 0.41.0  | 0.43.0        | examples/src/go.mod |
| https://osv.dev/GO-2026-4970        |      | Go        | stdlib                        | 1.26.4  | 1.26.5        | examples/src/go.mod |
| https://osv.dev/GO-2026-5856        |      | Go        | stdlib                        | 1.26.4  | 1.26.5        | examples/src/go.mod |
| https://osv.dev/GO-2026-5841        |      | Go        | github.com/klauspost/compress | 1.18.5  | 1.18.7        | go.mod              |
| https://osv.dev/GO-2026-5932        |      | Go        | golang.org/x/crypto           | 0.53.0  | --            | go.mod              |
| https://osv.dev/GO-2026-5942        |      | Go        | golang.org/x/net              | 0.55.0  | 0.56.0        | go.mod              |
| https://osv.dev/GO-2026-5970        |      | Go        | golang.org/x/text             | 0.38.0  | 0.39.0        | go.mod              |
| https://osv.dev/GO-2026-6061        | 8.8  | Go        | google.golang.org/grpc        | 1.82.0  | 1.82.1        | go.mod              |
| https://osv.dev/GHSA-hrxh-6v49-42gf |      |           |                               |         |               |                     |
| https://osv.dev/GO-2026-5880        | 7.1  | Go        | oras.land/oras-go/v2          | 2.6.1   | 2.6.2         | go.mod              |
| https://osv.dev/GHSA-fxhp-mv3v-67qp |      |           |                               |         |               |                     |
| https://osv.dev/GO-2026-4970        |      | Go        | stdlib                        | 1.26.4  | 1.26.5        | go.mod              |
| https://osv.dev/GO-2026-5856        |      | Go        | stdlib                        | 1.26.4  | 1.26.5        | go.mod              |
| https://osv.dev/GO-2026-5841        |      | Go        | github.com/klauspost/compress | 1.18.5  | 1.18.7        | test/go.mod         |
| https://osv.dev/GO-2026-5932        |      | Go        | golang.org/x/crypto           | 0.52.0  | --            | test/go.mod         |
| https://osv.dev/GO-2026-5942        |      | Go        | golang.org/x/net              | 0.55.0  | 0.56.0        | test/go.mod         |
| https://osv.dev/GO-2026-5970        |      | Go        | golang.org/x/text             | 0.37.0  | 0.39.0        | test/go.mod         |
| https://osv.dev/GO-2026-6061        | 8.8  | Go        | google.golang.org/grpc        | 1.81.1  | 1.82.1        | test/go.mod         |
| https://osv.dev/GHSA-hrxh-6v49-42gf |      |           |                               |         |               |                     |
| https://osv.dev/GO-2026-4970        |      | Go        | stdlib                        | 1.26.4  | 1.26.5        | test/go.mod         |
| https://osv.dev/GO-2026-5856        |      | Go        | stdlib                        | 1.26.4  | 1.26.5        | test/go.mod         |
+-------------------------------------+------+-----------+-------------------------------+---------+---------------+---------------------+

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

Show us your support by starring ⭐ the repository

Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) from 1.19.24 to 1.19.32. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@credentials/v1.19.24...credentials/v1.19.32) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.19.28 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-03T05:53:36Z

Looks like github.com/aws/aws-sdk-go-v2/credentials is up-to-date now, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 9, 2026

dependabot Bot mentioned this pull request Jul 9, 2026

build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.24 to 1.19.25 #312

Closed

dependabot Bot changed the title ~~build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.24 to 1.19.28~~ build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.24 to 1.19.32 Aug 2, 2026

dependabot Bot force-pushed the dependabot/go_modules/github.com/aws/aws-sdk-go-v2/credentials-1.19.28 branch from 105b899 to fa9e131 Compare August 2, 2026 20:14

dependabot Bot closed this Aug 3, 2026

dependabot Bot deleted the dependabot/go_modules/github.com/aws/aws-sdk-go-v2/credentials-1.19.28 branch August 3, 2026 05:53

Navigation Menu

build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.24 to 1.19.32 - #321

build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.24 to 1.19.32#321
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/aws/aws-sdk-go-v2/credentials-1.19.28

dependabot Bot commented on behalf of github Jul 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

dependabot Bot commented on behalf of github Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading